High Prio Issues 2024-09

[KernelDeimos]

This is just a start - I need to update this more later.

TODO

• Close any issues that are already resolved, Close any PRs that aren't real contributions
• Ensure tests can run (right now it looks like they fail)
  • Added an issue for this: Update tests #892
• Resolve high-prio issues, merge high-prio PRs

PRs

• https://github.com/http-party/http-server/pull/282/files - highly requested feature, missing docs and test. Should be merged and an issue should be open for the docs.
  • also check Added option for custom headers #885 and Added option for custom headers #887, take the best of each
  • Should be merged before other PRs for header flags (Feature/allow cross origin isolated #685 for example)
• https://github.com/http-party/http-server/pull/823/files - this should be verified; it definitely sucks when ports don't get closed

Nice to Have

• Add baseDir option, add -b flag to cli options to specify base path #294
• Proxy path option #439
• add darkmode support to directory listings #827

[indexzero]

Adding my list of issues & PRs worthy for consideration:

Issues

• Replace union in favor of Node streams Remove flatiron/union dependency #483

Pull Requests

• Easy Docker usage add dockerisation #867, Dockerize http-server #790
• IPv6 compatible loopback set default listener on ipv4 and ipv6 interfaces #830
• Upgrading dependencies to latest modern versions: Bump express from 4.17.1 to 4.17.3 #846, Bump async from 2.6.3 to 2.6.4 #808, regenerate package-lock.json #875, Bump qs from 6.5.2 to 6.5.3 #843

[KernelDeimos]

I just ran npm audit which updated some dependencies. All tests are still passing. Issue #860 turned out to be a false alarm. Any vulnerability that I know about is now therefore taken care of.

We could do a patch release on this alone before other changes go into main so that anyone configured to stay at the minor version gets a security update. Test coverage, while not perfect, is above 80% for most source files which seems to imply there's low risk of breaking changes, so I think we should do this.

[KernelDeimos]

I created a branch for v14.1.2 with the intention that it will only accept security-related fixes. This is my plan for the next three releases:

• v14.1.2; update anyone configured for patch updates with security fixes
• v14.2.0; update anyone configured for minor updates with stability improvements but no features
• v15.0.0; will have custom headers, basedir option, darkmode, etc

Edit: I now think v14.2.0 makes sense for all the current changes, as there should not be any regressions.